CVE-2020-20508

2021-09-2422:15:08

Google

osv.dev

shopkit

xss vulnerability

registration component

e-mail text field

user credentials hijack

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

37.3%

JSON

Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.

References

github.com/samnabi/shopkit/issues/223